v1.3.0

Kubernetes support. Nothing changes for compose: compose.yml, every setting
and the images' behaviour are as they were in 1.2.1 — only the version the
panel reports is new — so a compose stack can pull 1.3.0 or stay where it is. The new manifests reference the same images, so
kubectl apply -k deploy/kubernetes runs exactly what compose runs.

Added

• Kubernetes manifests, in deploy/kubernetes: the same four images as
  compose.yml, deployed with kubectl apply -k deploy/kubernetes. PostgreSQL
  runs as a StatefulSet on a PersistentVolumeClaim, the recursor keeps its
  forward zones on a small claim of its own and is published on port 53 by a
  LoadBalancer Service that preserves client addresses, and the panel sits
  behind a ClusterIP Service ready for an Ingress. Settings live in
  deploy/kubernetes/settings.env, the counterpart of .env; the secrets are
  generated straight into one Secret by scripts/k8s-secrets.sh, which
  never writes them to disk or puts them on a command line, and removes the
  first-run admin password once it has been used. The authoritative server's
  Service gets a fixed cluster IP, taken from PDNS_DNS_ADDRESS, for the same
  reason compose gives its container a fixed address: forward rules name IP
  addresses, not hosts. The walkthrough is on the Kubernetes page of the docs,
  and CI now validates the rendered manifests against the Kubernetes API schemas.

• scripts/k8s-secrets.sh creates and maintains the powerdns-secrets
  Secret: create generates every value inside the cluster, set KEY adds a
  provider secret from a silent prompt or stdin, admin-password shows the
  first-run password on a terminal only, and forget-admin-password deletes
  it once it has been used. Values travel to kubectl on stdin, so none is
  left on disk, in shell history or in ps.

Changed

• The panel reports its real version. /healthz and the start-up log
  said 1.0.0 in every release so far; they now carry the release number.

---

What's Changed

Other changes

• Run the stack on Kubernetes with kustomize manifests by @timothestoifl24 in #45
• Prepare the 1.3.0 release by @timothestoifl24 in #46

Full Changelog: v1.2.1...v1.3.0

Images

Published to ghcr.io, tagged 1.3.0:

• ghcr.io/timothestoifl24/pdns:1.3.0
• ghcr.io/timothestoifl24/pdns-recursor:1.3.0
• ghcr.io/timothestoifl24/pdns-db:1.3.0
• ghcr.io/timothestoifl24/pdns-webui:1.3.0

Upgrade notes: https://powerdns.stoifl.app/upgrading

v1.2.1

What's Changed

Other changes

• Give each zone a settings page, and link it to its reverse zones by @timothestoifl24 in #44

Full Changelog: v1.2.0...v1.2.1

Images

Published to ghcr.io, tagged 1.2.1:

• ghcr.io/timothestoifl24/pdns:1.2.1
• ghcr.io/timothestoifl24/pdns-recursor:1.2.1
• ghcr.io/timothestoifl24/pdns-db:1.2.1
• ghcr.io/timothestoifl24/pdns-webui:1.2.1

Upgrade notes: https://powerdns.stoifl.app/upgrading

v1.2.0

What's Changed

Other changes

• Manage reverse DNS alongside the forward side by @timothestoifl24 in #43

Full Changelog: v1.1.0...v1.2.0

Images

Published to ghcr.io, tagged 1.2.0:

• ghcr.io/timothestoifl24/pdns:1.2.0
• ghcr.io/timothestoifl24/pdns-recursor:1.2.0
• ghcr.io/timothestoifl24/pdns-db:1.2.0
• ghcr.io/timothestoifl24/pdns-webui:1.2.0

Upgrade notes: https://powerdns.stoifl.app/upgrading

v1.1.0

Moves the database to PostgreSQL 18, which existing deployments cannot take by
pulling: the data has to be dumped and reloaded, and the volume's mount point
changes with it. Read
upgrading
before you pull, and take the dump while 17 is still running.

Rehearse the reload on a copy before you do it for real. An empty volume starts
on 18 with nothing to do — that case is covered by CI — so the restore into the
new cluster is the only part that can genuinely go wrong, and the only part
nothing here can test for you.

A new stack is unaffected — docker compose up -d --build just starts on 18.

Breaking changes

• The db service is PostgreSQL 18, up from 17. PostgreSQL will not start
  against a data directory written by an older major version, so an existing
  pgdata volume must be dumped with pg_dumpall, deleted and reloaded. The
  upgrade guide has the exact sequence, including how to check the dump before
  the destructive step.

• The pgdata volume is mounted at /var/lib/postgresql, not at
  /var/lib/postgresql/data. The 18 image keeps the cluster in
  /var/lib/postgresql/18/docker and declares the parent directory as its
  volume, which is the layout pg_ctlcluster uses and what allows a future
  pg_upgrade --link to see both clusters without crossing a mount boundary.
  Anyone running a modified compose.yml needs to move this mount by hand.

  Left at the old path, the container stops with in 18+, these Docker images
  are configured to store database data in a format which is compatible with
  "pg_ctlcluster" rather than starting on an empty database beside the real
  one. That refusal is upstream's, and it is the good outcome: the data is
  still there.

Changed

• Dependabot's deliberate pin on the postgres major now holds the stack at
  18; the jump to 19 stays a planned dump and restore rather than a merged
  pull request.
• The upgrade guide gained a PostgreSQL 18 section covering the dump, the moved
  mount, verification afterwards, how to defer the upgrade, and why a rollback
  needs the 17 dump rather than a fresh one.

Fixed

• Podman's own DNS no longer collides with the recursor. Documented, not
  changed in code: Podman resolves container names with aardvark-dns, which
  binds port 53 on the bridge address (172.29.0.1 for the backend
  network). The default DNS_BIND_ADDRESS=0.0.0.0 claims port 53 on every
  address including that one, so the two cannot both start — with
  systemd-resolved running the recursor fails to publish, and with it
  stopped the recursor wins and aardvark-dns loses, leaving a stack that comes
  up but cannot resolve db. That second failure looks like stopping the
  resolver caused it, which is why it was worth writing down. Naming a real
  address for DNS_BIND_ADDRESS avoids both and lets systemd-resolved stay
  running; setup.md also covers moving aardvark-dns with
  dns_bind_port. The default stays 0.0.0.0, which is correct on Docker —
  its embedded DNS answers inside the container namespace and never competes
  for a host address.
• The images build under Podman. Every FROM now names its registry in
  full (docker.io/library/…). Podman has no implicit docker.io, so on a host
  without unqualified-search-registries in /etc/containers/registries.conf
  the bare names failed with short-name … did not resolve to an alias, and
  podman compose up --build reported it only as Build command failed at the
  end of the run. Docker resolves the fully qualified form identically, so
  nothing changes there.

---

What's Changed

Features

• Rebuild as a working PowerDNS + PostgreSQL stack with a Tabler admin panel by @timothestoifl24 in #8
• Run PowerDNS as an unprivileged database role by @timothestoifl24 in #9
• Add a VitePress documentation site, published to powerdns.stoifl.app by @timothestoifl24 in #10

Fixes

• Refactor requirements.txt to remove specific versioning for dependencies by @timothestoifl24 in #7
• ci: bump actions/checkout from 5 to 7 by @dependabot[bot] in #14
• ci: bump actions/setup-python from 6 to 7 by @dependabot[bot] in #16
• webui: update authlib requirement from <2.0,>=1.6.5 to >=1.7.2,<2.0 in /webui by @dependabot[bot] in #13
• webui: update requests requirement from <3.0,>=2.32 to >=2.34.2,<3.0 in /webui by @dependabot[bot] in #15
• webui: update psycopg requirement from <4.0,>=3.2 to >=3.3.4,<4.0 in /webui by @dependabot[bot] in #17
• webui: update flask requirement from <4.0,>=3.1 to >=3.1.3,<4.0 in /webui by @dependabot[bot] in #18
• images: bump python from 3.13-slim-trixie to 3.14-slim-trixie in /webui in the docker-minor-and-patch group across 1 directory by @dependabot[bot] in #12
• webui: update werkzeug requirement from <4.0,>=3.1 to >=3.1.8,<4.0 in /webui by @dependabot[bot] in #19

Other changes

• Update requirements.txt by @timothestoifl24 in #3
• Update Authlib version to 1.6.5 by @timothestoifl24 in #4
• Configure identity providers in the web UI, and enable Dependabot by @timothestoifl24 in #11
• webui: update gunicorn requirement from <24.0,>=23.0 to >=26.2.0,<27.0 in /webui by @dependabot[bot] in #20
• ci: bump actions/setup-node from 5 to 7 by @dependabot[bot] in #21
• Add a security policy by @timothestoifl24 in #22
• Keep the database rationale out of the published site by @timothestoifl24 in #24
• Resolve the code scanning alerts and the four docs advisories by @timothestoifl24 in #23
• Clear the last code scanning alert, and test on the Python the image ships by @timothestoifl24 in #25
• ci: bump actions/checkout from 5 to 7 by @dependabot[bot] in #29
• webui: update dnspython requirement from <3.0,>=2.7 to >=2.8.0,<3.0 in /webui by @dependabot[bot] in #28
• webui: update sqlalchemy requirement from <2.1,>=2.0.36 to >=2.0.52,<2.1 in /webui by @dependabot[bot] in #27
• webui: update jinja2 requirement from <4.0,>=3.1 to >=3.1.6,<4.0 in /webui by @dependabot[bot] in #26
• Forward zones and global forwarders, and fix LDAP role assignment by @timothestoifl24 in #30
• Add a changelog, automate the release notes, and document what shipped by @timothestoifl24 in #31
• Do not release a commit whose CI is still running by @timothestoifl24 in #32
• Publish images for arm64 as well as amd64 by @timothestoifl24 in #33
• Fix two races in the image build and smoke test by @timothestoifl24 in #34
• webui: update psycopg requirement from <4.0,>=3.3.4 to >=3.3.5,<4.0 in /webui by @dependabot[bot] in #35
• webui: update authlib requirement from <2.0,>=1.7.2 to >=1.8.0,<2.0 in /webui by @dependabot[bot] in #36
• ci: bump actions/download-artifact from 7 to 8 by @dependabot[bot] in #37
• Name the registry in every FROM so the images build under Podman by @timothestoifl24 in #38
• db: move to PostgreSQL 18 (pre-release 1.1.0-rc.1) by @timothestoifl24 in #39
• Release the PostgreSQL 18 change as 1.1.0-beta by @timothestoifl24 in #41
• webui: update sqlalchemy requirement from <2.1,>=2.0.52 to >=2.0.54,<2.1 in /webui by @dependabot[bot] in #40
• 1.1.0: correct the release notes, and document Podman's port 53 collision by @timothestoifl24 in #42

New Contributors

• @dependabot[bot] made their first contribution in #14

Full Changelog: v1.0.0...v1.1.0

Images

Published to ghcr.io, tagged 1.1.0:

• ghcr.io/timothestoifl24/pdns:1.1.0
• ghcr.io/timothestoifl24/pdns-recursor:1.1.0
• ghcr.io/timothestoifl24/pdns-db:1.1.0
• ghcr.io/timothestoifl24/pdns-webui:1.1.0

Upgrade notes: https://powerdns.stoifl.app/upgrading

v1.0.0

Full Changelog: https://github.com/timothestoifl24/powerdns/commits/v1.0.0